Tailscale for Jailbroken Kindle: Proxy and TUN Modes

Tailscale on Jailbroken Kindles now supports Proxy and TUN modes

Community updates to Tailscale implementations for jailbroken Kindles now allow these devices to act as more than just reachable nodes on a tailnet. By introducing Proxy Mode and Kernel TUN mode, users can now route outgoing traffic from Kindle applications to other devices on their private network, enabling secure access to self-hosted content servers.

Overcoming Userspace Networking Limitations

Standard Tailscale installations on jailbroken Kindles typically operate in userspace mode. In this mode, the Kindle is reachable via its Tailscale IP address, but it cannot route outgoing traffic from other apps (like KOReader) through the Tailscale network. When an app attempts to connect to a Tailscale IP (e.g., 100.x.y.z), the Kindle's root OS fails to route the request because it lacks the necessary network routing layer.

To solve this, an update to the Kindle KUAL app by developer greywolf1499 introduces two primary workarounds:

  1. Proxy Mode (SOCKS5/HTTP): This mode starts the tailscaled daemon listening on port 1055. Users can configure apps like KOReader to use 127.0.0.1:1055 as a proxy. The app sends the request to the proxy, and tailscaled routes the connection through the tailnet.
  2. Kernel TUN Mode: On supported Kindle models, this mode enables full device-level networking, allowing Tailscale to integrate directly with the device's network routing layer.

Practical Applications for Proxied E-readers

Enabling outgoing Tailscale connectivity transforms the Kindle into a functional thin client for private services. Practical use cases include:

  • Content Servers: Connecting to self-hosted Calibre, Wallabag, or Audiobookshelf servers.
  • Reading Synchronization: Using Readest to track reading progress across multiple devices.
  • RSS Feeds: Linking KOReader's RSS reader to a self-hosted feed server.
  • Remote Management: Using a Bluetooth keyboard and the kterm app to SSH into other devices on the tailnet.

The Tailscale KOReader Plugin

For users who primarily use the KOReader interface, a dedicated Tailscale plugin is available. This plugin automatically creates the necessary proxy interfaces for reaching content servers without requiring the full KUAL-based app.

Key details regarding the plugin:

  • Compatibility: Tested on Kindle PW5, PW6, Kobo, and PocketBook devices.
  • Installation: Requires copying the plugin to the KOReader directory, triggering an install/update via the menu, and providing a Tailscale auth key.
  • Configuration: Once active, KOReader is configured to use 127.0.0.1:1055 for SOCKS5 or :1056 for HTTP CONNECT.

Community Insights and Technical Considerations

Users and developers in the community have highlighted several technical trade-offs and suggestions for those implementing these tools:

  • Privacy and Metadata: Some users recommend adding the --no-logs-no-support flag to the tailscaled invocation to prevent the collection of behavioral metadata by Tailscale.
  • Battery and Stability: There are reports that combining KOReader, SSH, and Tailscale can significantly degrade battery life and cause frequent reboots or crashes on certain models, such as the Kindle Oasis.
  • Resource Usage: While some resource-constrained devices (like MIPS routers) require Rust-based ports of Tailscale due to RAM limits, Kindles released since 2019 generally have at least 512MB of RAM, which is sufficient for the standard tailscale-go implementation.
  • Alternative Software: Community members emphasize that KOReader provides significant advantages over stock Kindle software, including native dark mode and DRM support via plugins, making jailbreaking more attractive for older hardware.

Sources